Cyber Posture

CVE-2024-49834

High

Published: 03 February 2025

Published
03 February 2025
Modified
05 February 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 29.3th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-49834 is a high-severity Improper Validation of Array Index (CWE-129) vulnerability in Qualcomm Csra6620 Firmware. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 29.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Flaw remediation directly addresses the CVE by applying Qualcomm's recommended firmware or software patches to fix the memory corruption in camera sensor power sequences.

prevent

Memory protection mechanisms like address space layout randomization and data execution prevention comprehensively mitigate exploitation of memory corruption vulnerabilities such as this one.

prevent

Information input validation helps prevent improper array index handling (CWE-129) during camera sensor power-up or power-down sequences by ensuring parameters are checked for validity.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Local memory corruption in Qualcomm camera sensor power sequence directly enables privilege escalation via arbitrary code execution by low-privileged attacker.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Memory corruption while power-up or power-down sequence of the camera sensor.

Deeper analysisAI

CVE-2024-49834 is a memory corruption vulnerability (CWE-129) occurring during the power-up or power-down sequence of the camera sensor in Qualcomm products. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability. The issue affects components within Qualcomm chipsets or devices that handle camera sensor operations.

A local attacker with low privileges can exploit this vulnerability without user interaction by triggering the faulty power sequence, leading to memory corruption. Successful exploitation could allow the attacker to gain high-level control over the affected system, potentially executing arbitrary code, escalating privileges, or causing denial of service through crashes or data corruption.

Qualcomm's February 2025 security bulletin provides details on affected products and recommends applying the latest firmware or software patches to mitigate the vulnerability, as outlined at https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html. Security practitioners should verify device applicability and prioritize updates for systems with exposed camera sensors.

Details

CWE(s)

Affected Products

qualcomm
csra6620 firmware
all versions
qualcomm
csra6640 firmware
all versions
qualcomm
fastconnect 6200 firmware
all versions
qualcomm
fastconnect 6700 firmware
all versions
qualcomm
fastconnect 6900 firmware
all versions
qualcomm
fastconnect 7800 firmware
all versions
qualcomm
flight rb5 5g platform firmware
all versions
qualcomm
qam8255p firmware
all versions
qualcomm
qam8650p firmware
all versions
qualcomm
qam8775p firmware
all versions
+117 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2024-49833Same product: Qualcomm Fastconnect 6700
CVE-2024-53014Same product: Qualcomm Csra6620
CVE-2024-49843Same product: Qualcomm Fastconnect 6200
CVE-2024-49832Same product: Qualcomm Fastconnect 6900
CVE-2024-49836Same product: Qualcomm Fastconnect 6900
CVE-2025-47393Same product: Qualcomm Qam8255P
CVE-2024-49837Same product: Qualcomm Qam8255P
CVE-2024-53024Same product: Qualcomm Csra6620
CVE-2024-45569Same product: Qualcomm Fastconnect 6700
CVE-2025-47398Same product: Qualcomm Csra6620

References